Description

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course_ranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-31T06:17:08.103Z",
  "pubdate": "2026-08-31T06:17:08.103Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in Soarkey StudentManagement and 学生信息管理系统 up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e.\nThe vulnerability originates from the improper sanitization of the 'cno' argument within the 'CourseDao.course_ranking' function in 'code/src/dao/CourseDao.java'.\nThis flaw allows remote attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration, modification, or deletion.\nThe attack vector is remotely exploitable without requiring prior authentication, posing a severe risk to data confidentiality and integrity.\nAs the vulnerability details and exploit code are publicly available and the vendor has not provided a patch, active exploitation is a significant concern for deployments running the affected versions.",
  "technicalDetails": "The root cause of this vulnerability is the concatenation of user-supplied input into raw SQL queries within the 'CourseDao.course_ranking' function. By failing to utilize parameterized queries or prepared statements, the application treats the 'cno' argument as executable SQL syntax rather than as a literal data value.\nThe exploitation process begins when a remote attacker sends a specially crafted HTTP request containing a malicious payload in the 'cno' parameter. Because the input is unsanitized, the attacker can manipulate the query structure by injecting SQL control characters such as single quotes, comments, or union-based operators.\nThe attack flow proceeds as follows: 1) The application receives the request containing the tainted input. 2) The 'CourseDao.course_ranking' function takes this input and directly embeds it into an SQL statement string. 3) The database engine executes the concatenated string, inadvertently running the attacker's injected code. 4) The application returns the results of the malicious query or performs the attacker-desired action (e.g., dumping user credentials or modifying course records).\nThe impact is significant, as the vulnerability resides in a DAO (Data Access Object) layer, which typically interacts with sensitive database records. Exploitation allows an attacker to bypass standard application-level access controls, perform unauthorized information disclosure, and potentially gain administrative control over the backend database if the database service is misconfigured or lacks granular access restrictions.\nBecause the function is accessible remotely without authentication, this vulnerability is trivial to weaponize using automated SQL injection tools. The lack of input validation or effective sanitization at the DAO level ensures that any input passed to the 'cno' argument serves as a vector for database compromise.\nAffected systems include any deployment of the Soarkey StudentManagement and 学生信息管理系统 repositories up to commit hash e08f7f1d5015af407aa4cca0ada3dea189b4937e. There is currently no official patch available, leaving all instances on these versions permanently exposed to exploitation."
}